What changed in the funding model
MS-ISAC has provided state, local, tribal, and territorial governments with shared threat intelligence, security operations support, and other cybersecurity resources. Its operator, the Center for Internet Security (CIS), confirms that federal support ended September 30, 2025, and that a member-funded model began October 1. The loss of the subsidy changed the economics of participation; it did not mean the shared-service model ceased to exist. A jurisdiction that could not independently staff a round-the-clock security function may still benefit from pooled services, but it must now identify a sustainable purchasing arrangement.
Our focus is the continuity question that follows a funding change: which protections remain available, to whom, and on what terms? CIS: MS-ISAC membership FAQ and transition dates.
Coverage changes depend on the actual agreement
CIS describes phased offboarding for organizations that do not engage in the membership process, as well as specific transition arrangements for existing paid services and federally funded endpoint coverage. Those details matter more than a simple paid-versus-unprotected label. A statewide membership may cover multiple entities, but the buyer must confirm enrollment and included capabilities. An organization may also retain other protections from its state, a commercial provider, or its own team. Single-organization membership also remains an option; statewide purchasing is not the only route to coverage.
Coverage update checked October 1, 2026: CIS's FAQ says the federally funded EDR transition coverage for qualifying members ended September 30, 2026. Verify the replacement or paid coverage actually in place rather than assuming the bridge continues.
Budget pressure creates a risk of service gaps; it does not prove every nonmember has no protection.
Why affordability can become a security gap
A paid model can produce an affordability problem. A large security program may absorb a recurring fee more easily than a small county with one or two general IT staff. The smaller jurisdiction may also have greater dependence on shared expertise. The effect will depend on local budgets, existing coverage, and access to other services. States should measure the impact directly: which entities lost access, which substituted another service, and which are now missing monitoring or response support?
That inventory lets leaders target assistance rather than assume that either universal coverage or universal abandonment followed the funding change. Shared purchasing, regional cooperation, and targeted support can be evaluated against those observed gaps.
Check grant eligibility instead of assuming it
Grant availability and allowable costs need a source-specific review. A request to restore or reauthorize a program is not an enacted appropriation, and an authorization's expiry does not establish that every prior award or service ended on that date. NASCIO's 2026 advocacy priorities call for continued support for state and local cybersecurity. Buyers should distinguish that policy position from the terms of an actual award.
The FY 2025 SLCGP notice of funding opportunity expressly prohibits costs associated with CIS, including MS-ISAC and EI-ISAC membership and services. Section 3.F(g), page 19, is more specific than the notice's general requirement for advance FEMA approval of membership costs. Do not treat that general approval process as permission to charge an expressly prohibited cost to this award. FY 2025 SLCGP NOFO.
For other awards or funding sources, have the administering agency confirm the applicable terms rather than carrying the FY 2025 restriction or a generic approval rule into every context. Record the funding basis and a viable alternative if the intended source cannot pay the bill. The four-year FY 2025 performance period does not override its cost restrictions.
Retain enough internal capacity to direct the response
The deeper lesson is the difference between purchasing help and retaining responsibility. A shared service can extend a state's capability, but the state still needs people who know its assets, can make containment decisions, and can direct restoration. It is not necessary—or affordable—for every small jurisdiction to reproduce a full SOC internally. It is necessary to know which decisions remain local and which tasks the provider performs. Building staff, regional partnerships, and response procedures takes time; a sudden contract or funding change exposes that dependency.
Preserve system ownership, incident contacts, essential documentation, and the ability to work with a replacement provider. That is a more practical resilience objective than treating self-sufficiency as an all-or-nothing requirement.
Make continuity part of every shared-service contract
Shared-service procurement should include the possibility that price, scope, funding, or access will change. Evaluate the total cost of continuity, not simply the annual membership line. Ask how alerts, retained evidence, reports, configurations, and knowledge transfer will be handled at exit. Identify which functions require uninterrupted operation and which can tolerate a temporary manual process. Set review dates early enough to make a purchasing decision before coverage expires. Shared services can remain the right economic choice, especially for smaller jurisdictions; the lesson is to make dependencies explicit and manageable.
A tested fallback and a named risk owner turn a funding surprise into a planned transition rather than an unassigned operational gap.
Check coverage before the renewal window closes
A continuity plan needs a service-by-service answer, including the capabilities that are easiest to overlook.
- Inventory the services actually used. List intelligence feeds, monitoring, incident response, training, endpoint coverage, and add-ons with an owner and renewal date for each.
- Confirm coverage in writing. Verify whether a statewide arrangement covers local entities, what onboarding is required, and which services have separate fees or transition dates.
- Test the replacement before access ends. Confirm alert delivery, escalation contacts, log availability, and who will investigate an incident outside office hours.
- Check funding allowability. Apply the exact award terms, including the FY 2025 CIS/MS-ISAC prohibition. Obtain required determinations for other sources; a generic approval process does not override an express restriction.
- Practice operating without the service. Run a short continuity exercise, preserve critical contacts and evidence, and document which capabilities cannot be maintained internally.
Trace one alert across the membership boundary
Consider a hypothetical county that retains a membership but changes its endpoint service. Threat information may still arrive while endpoint investigation, response assistance or another add-on follows a different agreement. Paying one invoice does not establish that every former capability continues.
Build a service map using the actual agreements. For each capability, identify the covered entities, assets, service hours, provider, local owner, funding source and end date. Confirm that the county is enrolled under any statewide arrangement and that the assets needing protection are actually connected.
Then run an authorized, controlled alert exercise. Verify that the alert reaches the intended team, contains usable asset context and produces contact with a person able to act. Establish who investigates, who approves containment and who supports recovery. If an agreement changes, retest the affected handoff rather than relying on the prior contact list.
A gap may be commercial, technical or organizational. Missing coverage requires a purchasing or scope decision. A disconnected agent requires engineering work. An alert that reaches a mailbox without an assigned responder requires an operating decision. Treating all three as a need to buy another security product can leave the actual problem untouched.
Choose a funded continuity option before access ends
A statewide arrangement, regional purchase, individual membership or different provider may be appropriate depending on the service and authority. Compare the capabilities actually delivered, not only the membership price. Include onboarding, local staff time, transition work, retained evidence and any functions that still require separate support.
If funding is unavailable for the preferred option, document the reduced coverage and its consequences for the responsible executive. Do not imply that an unfunded service will continue or that a general grant approval rule overrides a specific prohibition. Identify which alternative can actually be supported and when it can be operational.
At handoff, verify access to the records and configurations the agreement permits, preserve incident contacts and identify work still open with the former provider. Some historical evidence may require a separate retention or access arrangement. Confirm that before it is needed during an incident.
The practical closeout is a tested coverage map with a funding basis and named responders. That lets leadership decide where shared services remain the right choice and where another arrangement is needed without assuming either complete protection or complete abandonment.
Sources and further reading
- CISA: FY 2025 SLCGP general program changes
- CIS: MS-ISAC membership FAQ and transition dates
- CIS: MS-ISAC service and governance overview
- NASCIO: 2026 federal advocacy priorities
Spartan X's cybersecurity and program execution perspective is straightforward: shared services are valuable when their dependencies are understood, their responsibilities are explicit, and the customer retains a workable path through change.
